5 ms·

Why do you think the two are mutually exclusive? I was under the impression that the NSA publishes security advisories all the time?

gkop 11y ago
At least one issue is perception of the NSA by the talented people that the NSA needs to recruit. At the time I graduated CS undergrad in 2010, the NSA was still seen as "Sketchy, but good (and reliable) on the balance." Post-Snowden, views have changed. If the NSA can't do a better job of public relations, nobody is going to want to work for them, and then this defensive work won't be done as well.
- Mtinie 11y ago
  Conscription neatly solves that problem... Given the proper motivation (neé, "a carrot-shaped stick"), a potential prospect will be inclined to accept the offer of employment.
  - ionised 11y ago
    Forcing people to work for you is a surefire way to ensure they do a terrible or half-arsed job. Worse, they may even actively do a bad job in the hope of doing damage. Plus, the whole idea of conscription is absurd.
    - Mtinie 11y ago
      Apparently I needed to include a "/s" on my comment. No, conscription is most assuredly not the answer :)
hibikir 11y ago
For the most part, any party the NSA might be interested into is going to be running an OS and an application suite that will also be used by Americans a whole lot. Probably even other government agencies. So, every zero day they find and weaponize, is a zero day that they don't tell the vendor about. So to be able to be aggressive with exploits, they have to leave American computers exposed too, and hope nobody else has found the exploit. So even with the same budget looking for vulnerabilities, doing the right thing for one of their roles makes them worse for the other. It's a bit like the encryption problem: An encryption system with a backdoor that the NSA has weakens American security too, because the backdoor itself is a valid intelligence target: Infiltrate the NSA, take the backdoor key, and anything the NSA can snoop into, someone else can too. So doing both defense and offense without major tradeoffs requires having some kind of edge that nobody else can ever have: For instance, the rumored gigantic cluster that can crack specific SSH communications, which they expect nobody else to be able to replicate, just due to the cost of the hardware. That's a far more limited offense than what we know the NSA had at the time of the Snowden leaks. So my guess, based on public information, is that they do trade-offs, and disclose the issues that they think are easier to find, while keeping around enough ammunition to have something against pretty much every target.

gkop 11y ago

At least one issue is perception of the NSA by the talented people that the NSA needs to recruit. At the time I graduated CS undergrad in 2010, the NSA was still seen as "Sketchy, but good (and reliable) on the balance." Post-Snowden, views have changed. If the NSA can't do a better job of public relations, nobody is going to want to work for them, and then this defensive work won't be done as well.

Mtinie 11y ago
Conscription neatly solves that problem... Given the proper motivation (neé, "a carrot-shaped stick"), a potential prospect will be inclined to accept the offer of employment.
- ionised 11y ago
  Forcing people to work for you is a surefire way to ensure they do a terrible or half-arsed job. Worse, they may even actively do a bad job in the hope of doing damage. Plus, the whole idea of conscription is absurd.
  - Mtinie 11y ago
    Apparently I needed to include a "/s" on my comment. No, conscription is most assuredly not the answer :)

hibikir 11y ago

For the most part, any party the NSA might be interested into is going to be running an OS and an application suite that will also be used by Americans a whole lot. Probably even other government agencies. So, every zero day they find and weaponize, is a zero day that they don't tell the vendor about. So to be able to be aggressive with exploits, they have to leave American computers exposed too, and hope nobody else has found the exploit. So even with the same budget looking for vulnerabilities, doing the right thing for one of their roles makes them worse for the other. It's a bit like the encryption problem: An encryption system with a backdoor that the NSA has weakens American security too, because the backdoor itself is a valid intelligence target: Infiltrate the NSA, take the backdoor key, and anything the NSA can snoop into, someone else can too. So doing both defense and offense without major tradeoffs requires having some kind of edge that nobody else can ever have: For instance, the rumored gigantic cluster that can crack specific SSH communications, which they expect nobody else to be able to replicate, just due to the cost of the hardware. That's a far more limited offense than what we know the NSA had at the time of the Snowden leaks. So my guess, based on public information, is that they do trade-offs, and disclose the issues that they think are easier to find, while keeping around enough ammunition to have something against pretty much every target.